PT-2010-1324 · Oftc+2 · Oftc-Hybrid+2

David Leadbeater · Published 2010-02-04 · Updated 2010-02-05 · CVE-2009-4016

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IRCD-hybrid versions 7.2.2 through 7.2.3 ircd-ratbox versions prior to 2.2.9 oftc-hybrid versions prior to 1.6.8

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a LINKS command, due to an integer underflow in the clean string function when flatten links is disabled.

Recommendations For IRCD-hybrid versions 7.2.2 through 7.2.3, update to a version later than 7.2.3. For ircd-ratbox versions prior to 2.2.9, update to version 2.2.9 or later. For oftc-hybrid versions prior to 1.6.8, update to version 1.6.8 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-4016

DSA-1980-1

Affected Products

Ircd-Hybrid

Ircd-Ratbox

Oftc-Hybrid

References · 17

• https://osv.dev/vulnerability/UBUNTU-CVE-2009-4016 · Vendor Advisory
• http://secunia.com/advisories/38382 · Vendor Advisory
• http://secunia.com/advisories/38210 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-4016 · Vendor Advisory
• http://secunia.com/advisories/38381 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4016 · Security Note
• http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gz · Patch
• https://ubuntu.com/security/CVE-2009-4016 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-4016 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2009-4016 · Security Note
• http://secunia.com/advisories/38383 · Vendor Advisory
• http://debian.org/security/2010/dsa-1980 · Patch, Vendor Advisory
• http://trac.oftc.net/projects/oftc-hybrid/browser/tags/oftc-hybrid-1.6.8/RELNOTES · Note
• http://securityfocus.com/bid/37978 · Note